agnostic-ai 0.63.0 → 0.64.1

package/README.md

@@ -27,9 +27,11 @@ curl -fsSL https://raw.githubusercontent.com/Chemaclass/agnostic-ai/main/scripts
 
 Windows, Go, and manual download are covered in [all install options](https://agnostic-ai.org/docs/installation/).
 
-This package is a thin wrapper: it downloads the prebuilt Go binary for your platform from [GitHub Releases](https://github.com/Chemaclass/agnostic-ai/releases) and runs it. Supported platforms are macOS, Linux, and Windows on x64 and arm64.
+This package is a thin wrapper around the prebuilt Go binary. The binary ships inside a platform package (`@agnostic-ai/darwin-arm64` and five siblings), declared as optional dependencies. npm reads each one's `os` and `cpu` and installs only the one that matches your machine. Supported platforms are macOS, Linux, and Windows on x64 and arm64.
 
-The download normally happens on install. Under npm's install-script gating (`--ignore-scripts`, or npm 11's default prompt), it happens on first run instead. Set `AGNOSTIC_AI_VERSION` to any [release tag](https://github.com/Chemaclass/agnostic-ai/releases) to pin a different binary.
+Nothing is downloaded and no install script runs, so the package works under `--ignore-scripts`, behind a proxy, and from an offline npm mirror. To pin a version, pin the package: `npm install -g agnostic-ai@<version>`.
+
+Set `AGNOSTIC_AI_BINARY` to an absolute path to run a binary this package does not ship, such as one you built yourself.
 
 Full docs, targets, and configuration: [agnostic-ai.org](https://agnostic-ai.org).
 

package/bin/agnostic-ai.js

@@ -3,14 +3,79 @@
 
 const { spawnSync } = require('node:child_process')
 const os = require('node:os')
-const { ensureBinary } = require('../lib/download')
+const path = require('node:path')
+const { entryPoint, packageName, platformFor } = require('../lib/platforms')
 
-async function main() {
+const DOCS = 'https://agnostic-ai.org/docs/installation/'
+
+// A global install resolves its dependencies from the global tree, a project
+// install from the project's, and `npm install` without `-g` only ever writes
+// the second. Telling a globally installed CLI to run the project command
+// leaves it exactly as broken as it was, so the repair hint has to know which
+// tree it is sitting in.
+//
+// npm puts a global package under its own prefix: `<prefix>/lib/node_modules`
+// on macOS and Linux, `<prefix>\node_modules` on Windows, where <prefix> is
+// npm's own directory (commonly `.../npm`). A project install sits in a
+// `node_modules` whose parent is the project. Unrecognised layouts fall back
+// to the project command, which is the common case, and the message names the
+// other form either way.
+function isGlobalInstall(dir) {
+  const parts = path.resolve(dir).split(path.sep)
+  const i = parts.lastIndexOf('node_modules')
+  if (i < 1) return false
+  return parts[i - 1] === 'lib' || parts[i - 1] === 'npm'
+}
+
+// The binary ships inside a platform package that npm installed as an optional
+// dependency, so finding it is a module lookup, not a download. Nothing here
+// touches the network.
+function resolveBinary() {
+  // Escape hatch for a binary this package does not ship: a local build, an
+  // unsupported CPU, an air-gapped machine that already has one on disk.
+  const override = process.env.AGNOSTIC_AI_BINARY
+  if (override) return override
+
+  const platform = platformFor(process.platform, process.arch)
+  if (!platform) {
+    throw new Error(
+      `no prebuilt binary for ${process.platform}/${process.arch}. Build one with ` +
+        '`go install github.com/chemaclass/agnostic-ai/cmd/agnostic-ai@latest` and point ' +
+        `AGNOSTIC_AI_BINARY at it, or pick another route: ${DOCS}`
+    )
+  }
+
+  try {
+    return require.resolve(entryPoint(platform))
+  } catch {
+    // npm reuses a lockfile written on another platform without re-resolving
+    // optional dependencies, which leaves the matching package absent
+    // (npm/cli#4828). `--no-optional` and `--omit=optional` do the same on
+    // purpose. Both look like a successful install until the CLI runs.
+    //
+    // --include=optional is not decoration: the second cause is an
+    // `omit=optional` sitting in the user's npm config, and a plain reinstall
+    // obeys it and skips the package again.
+    const isGlobal = isGlobalInstall(__dirname)
+    const scope = isGlobal ? 'installed globally' : 'installed in this project'
+    const fix = isGlobal
+      ? 'npm install -g agnostic-ai --force --include=optional'
+      : 'npm install agnostic-ai --force --include=optional'
+    const other = isGlobal ? 'drop -g for a project install' : 'add -g for a global install'
+    throw new Error(
+      `${packageName(platform)} is not installed, so there is no binary to run. npm installs ` +
+        'it as an optional dependency; a lockfile copied from another platform or an install ' +
+        `run with --omit=optional skips it. This copy is ${scope}, so reinstall with ` +
+        `\`${fix}\` (${other}), or set AGNOSTIC_AI_BINARY to a binary you already have. ` +
+        `Other routes: ${DOCS}`
+    )
+  }
+}
+
+function main() {
   let binary
   try {
-    // Normally already on disk from postinstall; this covers an install that
-    // ran with --ignore-scripts or without network.
-    binary = await ensureBinary({ log: (m) => console.error(`agnostic-ai: ${m}`) })
+    binary = resolveBinary()
   } catch (err) {
     console.error(`agnostic-ai: ${err.message}`)
     process.exit(1)

package/lib/platforms.js

@@ -0,0 +1,64 @@
+'use strict'
+
+// The one table the whole npm distribution reads: the bin shim uses it to find
+// the binary at runtime, scripts/build-platform-packages.js uses it to emit the
+// packages at release time, and the parent package.json pins the same six names
+// in optionalDependencies.
+//
+// Keeping it in one file is the point. npm skips an optional dependency whose
+// `os` or `cpu` does not match the machine, and it skips it silently, so a pair
+// that disagrees with what the shim asks for installs nothing and leaves the CLI
+// missing with no error anywhere. Two copies of this table is how that happens.
+
+// Published under the project's npm organization. The dedicated scope keeps
+// ownership separate from a maintainer account, and makes the project name in
+// each package redundant: `@agnostic-ai/win32-x64` already identifies both.
+const SCOPE = '@agnostic-ai'
+
+const BINARY = 'agnostic-ai'
+
+// `os` and `cpu` are npm's own spellings, matched against process.platform and
+// process.arch. `goos` and `goarch` are Go's, and name the release archive the
+// binary is extracted from. The two vocabularies differ on win32/windows and
+// x64/amd64, which is the mapping this table exists to hold.
+const PLATFORMS = [
+  { os: 'darwin', cpu: 'arm64', goos: 'darwin', goarch: 'arm64' },
+  { os: 'darwin', cpu: 'x64', goos: 'darwin', goarch: 'amd64' },
+  { os: 'linux', cpu: 'arm64', goos: 'linux', goarch: 'arm64' },
+  { os: 'linux', cpu: 'x64', goos: 'linux', goarch: 'amd64' },
+  { os: 'win32', cpu: 'arm64', goos: 'windows', goarch: 'arm64' },
+  { os: 'win32', cpu: 'x64', goos: 'windows', goarch: 'amd64' },
+]
+
+function packageName(platform) {
+  return `${SCOPE}/${platform.os}-${platform.cpu}`
+}
+
+function binaryName(platform) {
+  return platform.os === 'win32' ? `${BINARY}.exe` : BINARY
+}
+
+// What the shim hands require.resolve(). A subpath of the platform package, so
+// Node walks the same node_modules lookup npm just populated.
+function entryPoint(platform) {
+  return `${packageName(platform)}/${binaryName(platform)}`
+}
+
+function platformFor(nodeOs, nodeCpu) {
+  return PLATFORMS.find((p) => p.os === nodeOs && p.cpu === nodeCpu)
+}
+
+// Exact pins, never a range. A platform package carries a binary built from one
+// commit, so a caret would let npm pair a new CLI with an old binary.
+function optionalDependencies(version) {
+  return Object.fromEntries(PLATFORMS.map((p) => [packageName(p), version]))
+}
+
+module.exports = {
+  PLATFORMS,
+  binaryName,
+  entryPoint,
+  optionalDependencies,
+  packageName,
+  platformFor,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agnostic-ai",
-  "version": "0.63.0",
+  "version": "0.64.1",
   "description": "One spec, every AI CLI. Sync agents, skills, rules, hooks, and MCP servers to Claude Code, Codex, Gemini, Cursor, Copilot, and 20 more.",
   "keywords": [
     "ai",
@@ -39,25 +39,22 @@
     "agnostic-ai": "bin/agnostic-ai.js"
   },
   "files": [
-    "bin/",
-    "lib/",
-    "scripts/",
+    "bin/agnostic-ai.js",
+    "lib/platforms.js",
     "README.md"
   ],
   "scripts": {
-    "postinstall": "node scripts/postinstall.js",
-    "test": "node lib/download_test.js"
+    "test": "node lib/platforms_test.js && node scripts/build-platform-packages_test.js"
   },
   "engines": {
     "node": ">=18"
   },
-  "os": [
-    "darwin",
-    "linux",
-    "win32"
-  ],
-  "cpu": [
-    "x64",
-    "arm64"
-  ]
+  "optionalDependencies": {
+    "@agnostic-ai/darwin-arm64": "0.64.1",
+    "@agnostic-ai/darwin-x64": "0.64.1",
+    "@agnostic-ai/linux-arm64": "0.64.1",
+    "@agnostic-ai/linux-x64": "0.64.1",
+    "@agnostic-ai/win32-arm64": "0.64.1",
+    "@agnostic-ai/win32-x64": "0.64.1"
+  }
 }

package/lib/download.js

@@ -1,266 +0,0 @@
-'use strict'
-
-// Fetches the agnostic-ai release binary for the current platform. Shared by
-// the postinstall hook and the bin shim, so a failed install still recovers on
-// first run instead of leaving a broken command.
-
-const { execFileSync } = require('node:child_process')
-const crypto = require('node:crypto')
-const fs = require('node:fs')
-const http = require('node:http')
-const https = require('node:https')
-const os = require('node:os')
-const path = require('node:path')
-
-const REPO = 'Chemaclass/agnostic-ai'
-const BINARY = process.platform === 'win32' ? 'agnostic-ai.exe' : 'agnostic-ai'
-
-const PLATFORMS = { darwin: 'darwin', linux: 'linux', win32: 'windows' }
-const ARCHS = { x64: 'amd64', arm64: 'arm64' }
-
-// GitHub redirects a release asset to object storage exactly once, so five hops
-// is slack for a proxy in the way while still ending a redirect loop.
-const MAX_REDIRECTS = 5
-
-// Silence, not slowness, is what this catches: the archives are a few MB, so 30
-// seconds without a single byte means the connection is wedged. Left unbounded,
-// the OS connect timeout alone runs to 75 seconds, and a server that accepts and
-// never answers never times out at all. This runs inside postinstall, where a
-// stall blocks `npm install` for the whole project.
-const TIMEOUT_MS = 30_000
-
-function target() {
-  const goos = PLATFORMS[process.platform]
-  const goarch = ARCHS[process.arch]
-  if (!goos || !goarch) {
-    throw new Error(
-      `agnostic-ai has no prebuilt binary for ${process.platform}/${process.arch}. ` +
-        'Build from source: go install github.com/chemaclass/agnostic-ai/cmd/agnostic-ai@latest'
-    )
-  }
-  return { goos, goarch, ext: goos === 'windows' ? 'zip' : 'tar.gz' }
-}
-
-function assetName() {
-  const { goos, goarch, ext } = target()
-  return `agnostic-ai_${goos}_${goarch}.${ext}`
-}
-
-function binaryPath() {
-  return path.join(__dirname, '..', 'bin', BINARY)
-}
-
-// Node throws an AggregateError with an empty `message` when a host resolves to
-// several addresses and every connection fails, which is the ordinary shape of
-// github.com behind a firewall. Printing `err.message` then prints nothing, so
-// rebuild a message out of what the error does carry.
-function describeError(err) {
-  if (!err || err.message) return err
-
-  const codes = new Set()
-  const causes = new Set()
-  if (err.code) codes.add(err.code)
-  for (const cause of Array.isArray(err.errors) ? err.errors : []) {
-    if (!cause) continue
-    if (cause.code) codes.add(cause.code)
-    if (cause.message) causes.add(cause.message)
-  }
-
-  const summary = codes.size ? [...codes].join(', ') : `${err.name || 'Error'} with no message`
-  const described = new Error(causes.size ? `${summary}: ${[...causes].join('; ')}` : summary)
-  described.cause = err
-  return described
-}
-
-function client(url) {
-  if (url.startsWith('https:')) return https
-  // Only reachable through a redirect; kept so a plain http hop reports
-  // something readable instead of ERR_INVALID_PROTOCOL.
-  if (url.startsWith('http:')) return http
-  throw new Error(`GET ${url} uses an unsupported protocol`)
-}
-
-// Resolves once the response headers are in, with a `body()` that reads the
-// rest. Splitting it that way lets a caller act on the headers alone, and keeps
-// the one timeout covering both halves: the socket timeout fires on silence
-// whether or not the body has started, and a request torn down by it must
-// report the timeout rather than the `aborted` the stream raises in its wake.
-function request(url, timeoutMs) {
-  return new Promise((resolve, reject) => {
-    let timedOut = null
-    const fail = (err) => reject(timedOut || describeError(err))
-
-    const req = client(url)
-      .get(url, { headers: { 'user-agent': 'agnostic-ai-npm' }, timeout: timeoutMs }, (res) => {
-        resolve({
-          res,
-          body: () =>
-            new Promise((done, failBody) => {
-              const chunks = []
-              res.on('data', (c) => chunks.push(c))
-              res.on('end', () => done(Buffer.concat(chunks)))
-              res.on('error', (err) => failBody(timedOut || describeError(err)))
-            }),
-        })
-      })
-      .on('timeout', () => {
-        // The socket timeout only raises the event; the request has to be torn
-        // down by hand, and destroy(err) is what surfaces as a rejection.
-        timedOut = new Error(`GET ${url} timed out after ${timeoutMs / 1000}s of silence`)
-        req.destroy(timedOut)
-      })
-      .on('error', fail)
-  })
-}
-
-// Drain a response nobody will read. The listener is not optional: a response
-// that errors with nothing attached takes the whole process down.
-function discard(res) {
-  res.resume()
-  res.on('error', () => {})
-}
-
-function redirectTo(res) {
-  const { statusCode, headers } = res
-  return statusCode >= 300 && statusCode < 400 && headers.location ? headers.location : ''
-}
-
-async function get(url, { redirects = 0, timeoutMs = TIMEOUT_MS } = {}) {
-  const { res, body } = await request(url, timeoutMs)
-
-  // GitHub redirects release assets to a signed object-store URL.
-  const next = redirectTo(res)
-  if (next) {
-    discard(res)
-    if (redirects >= MAX_REDIRECTS) {
-      throw new Error(`GET ${url} still redirecting after ${MAX_REDIRECTS} hops`)
-    }
-    if (url.startsWith('https:') && next.startsWith('http:')) {
-      throw new Error(`GET ${url} redirects to plain http (${next}); refusing`)
-    }
-    return get(next, { redirects: redirects + 1, timeoutMs })
-  }
-
-  if (res.statusCode !== 200) {
-    discard(res)
-    throw new Error(`GET ${url} failed with HTTP ${res.statusCode}`)
-  }
-  return body()
-}
-
-// Release tags carry the `v`, but `npm view` and package.json print the bare
-// number, so both spellings of AGNOSTIC_AI_VERSION have to reach the same tag.
-// Anything that does not start with a digit is passed through untouched.
-function releaseTag(version) {
-  const trimmed = version.trim()
-  return /^\d/.test(trimmed) ? `v${trimmed}` : trimmed
-}
-
-// `releases/latest` on github.com answers 302 to the tag page, so the tag is in
-// the Location header. That keeps release resolution off api.github.com, which
-// allows 60 unauthenticated requests an hour per IP: a shared CI address burns
-// through that and every install then fails with HTTP 403 (#940). The redirect
-// target is what this wants, so it reads the response itself instead of going
-// through get(), which exists to follow the redirect and hand back a body.
-async function latestTag(url = `https://github.com/${REPO}/releases/latest`) {
-  const { res } = await request(url, TIMEOUT_MS)
-  discard(res)
-
-  const location = redirectTo(res)
-  if (location) {
-    const tag = decodeURIComponent(location.split('/').pop() || '')
-    if (/^v?\d/.test(tag)) return tag
-    throw new Error(`could not read a release tag out of ${location}`)
-  }
-  if (res.statusCode === 403 || res.statusCode === 429) {
-    throw new Error(
-      `GitHub rate-limited the release lookup (HTTP ${res.statusCode}). Retry in a few ` +
-        'minutes, or pin the binary with AGNOSTIC_AI_VERSION=vX.Y.Z'
-    )
-  }
-  if (res.statusCode === 404) {
-    throw new Error(
-      `${REPO} reports no published release (HTTP 404). Pin one with AGNOSTIC_AI_VERSION=vX.Y.Z`
-    )
-  }
-  throw new Error(`could not resolve the latest agnostic-ai release: HTTP ${res.statusCode}`)
-}
-
-// The published package carries the release version; a checkout carries the
-// 0.0.0-dev placeholder, which has no matching release, so fall back to latest.
-async function resolveVersion() {
-  if (process.env.AGNOSTIC_AI_VERSION) return releaseTag(process.env.AGNOSTIC_AI_VERSION)
-
-  const { version } = require('../package.json')
-  if (version && !version.startsWith('0.0.0')) return releaseTag(version)
-
-  return latestTag()
-}
-
-function downloadUrl(version, asset) {
-  return `https://github.com/${REPO}/releases/download/${version}/${asset}`
-}
-
-async function verifyChecksum(archive, asset, version) {
-  const sums = (await get(downloadUrl(version, 'checksums.txt'))).toString('utf8')
-  const line = sums.split('\n').find((l) => l.trim().endsWith(asset))
-  if (!line) throw new Error(`${asset} missing from checksums.txt`)
-
-  const expected = line.trim().split(/\s+/)[0]
-  const actual = crypto.createHash('sha256').update(fs.readFileSync(archive)).digest('hex')
-  if (actual !== expected) throw new Error(`checksum mismatch for ${asset}`)
-}
-
-function extract(archive, dir) {
-  // bsdtar reads both tar.gz and zip, and ships with macOS and Windows 10
-  // 1803+; Linux only ever gets the tar.gz here, so GNU tar is fine too.
-  try {
-    execFileSync('tar', ['-xf', archive, '-C', dir, BINARY], { stdio: 'ignore' })
-  } catch (err) {
-    const reason = err.code === 'ENOENT' ? 'tar is not installed' : describeError(err).message
-    throw new Error(
-      `could not extract ${path.basename(archive)}: ${reason}. Install agnostic-ai another ` +
-        'way instead: go install github.com/chemaclass/agnostic-ai/cmd/agnostic-ai@latest, ' +
-        'or the routes at https://agnostic-ai.org/docs/installation/'
-    )
-  }
-}
-
-async function ensureBinary({ log = () => {} } = {}) {
-  const dest = binaryPath()
-  if (fs.existsSync(dest)) return dest
-
-  const version = await resolveVersion()
-  const asset = assetName()
-  log(`downloading agnostic-ai ${version} (${asset})`)
-
-  const work = fs.mkdtempSync(path.join(os.tmpdir(), 'agnostic-ai-'))
-  try {
-    const archive = path.join(work, asset)
-    fs.writeFileSync(archive, await get(downloadUrl(version, asset)))
-    await verifyChecksum(archive, asset, version)
-    extract(archive, work)
-
-    fs.mkdirSync(path.dirname(dest), { recursive: true })
-    fs.copyFileSync(path.join(work, BINARY), dest)
-    fs.chmodSync(dest, 0o755)
-  } finally {
-    fs.rmSync(work, { recursive: true, force: true })
-  }
-
-  log(`installed ${dest}`)
-  return dest
-}
-
-module.exports = {
-  assetName,
-  binaryPath,
-  describeError,
-  downloadUrl,
-  ensureBinary,
-  extract,
-  get,
-  latestTag,
-  resolveVersion,
-  target,
-}

package/lib/download_test.js

@@ -1,325 +0,0 @@
-'use strict'
-
-// Run: node npm/lib/download_test.js  (or npm test inside npm/)
-//
-// Covers the pure mapping logic plus the failure paths of the download: every
-// server here is a throwaway listener on 127.0.0.1, so the suite needs no
-// network and no dependencies. The happy path is exercised end to end by
-// .github/workflows/install.yml against a real release.
-
-const assert = require('node:assert')
-const { spawnSync } = require('node:child_process')
-const fs = require('node:fs')
-const http = require('node:http')
-const https = require('node:https')
-const net = require('node:net')
-const os = require('node:os')
-const path = require('node:path')
-const {
-  assetName,
-  binaryPath,
-  describeError,
-  downloadUrl,
-  extract,
-  get,
-  latestTag,
-  resolveVersion,
-  target,
-} = require('./download')
-
-function listen(server) {
-  return new Promise((resolve) => {
-    server.listen(0, '127.0.0.1', () => resolve(`http://127.0.0.1:${server.address().port}`))
-  })
-}
-
-function close(server, sockets = []) {
-  return new Promise((resolve) => {
-    // close() alone waits for every open connection: the keep-alive sockets an
-    // http.Server holds, and the one the wedged server keeps open on purpose.
-    // Drop both, or the suite hangs here.
-    if (server.closeAllConnections) server.closeAllConnections()
-    for (const socket of sockets) socket.destroy()
-    server.close(resolve)
-  })
-}
-
-async function rejection(promise) {
-  try {
-    await promise
-  } catch (err) {
-    return err
-  }
-  throw new Error('expected the promise to reject')
-}
-
-function thrown(fn) {
-  try {
-    fn()
-  } catch (err) {
-    return err
-  }
-  throw new Error('expected the call to throw')
-}
-
-// A real AggregateError, thrown by Node itself: the custom lookup hands the
-// connect both loopback addresses so every attempt fails, which is the shape of
-// github.com resolving to several IPs behind a firewall. Both refuse instantly,
-// so this stays fast and needs no network.
-function multiAddressFailure(port) {
-  return new Promise((resolve) => {
-    https
-      .get(
-        `https://localhost:${port}/x`,
-        {
-          autoSelectFamily: true,
-          lookup: (host, opts, cb) =>
-            cb(null, [
-              { address: '127.0.0.1', family: 4 },
-              { address: '::1', family: 6 },
-            ]),
-        },
-        () => {}
-      )
-      .on('error', resolve)
-  })
-}
-
-function closedPort() {
-  return new Promise((resolve) => {
-    const probe = net.createServer()
-    probe.listen(0, '127.0.0.1', () => {
-      const { port } = probe.address()
-      probe.close(() => resolve(port))
-    })
-  })
-}
-
-const tests = {
-  'asset name matches the release archive for this platform'() {
-    const { goos, goarch } = target()
-    const expected = goos === 'windows'
-      ? `agnostic-ai_${goos}_${goarch}.zip`
-      : `agnostic-ai_${goos}_${goarch}.tar.gz`
-    assert.strictEqual(assetName(), expected)
-  },
-
-  'windows gets a zip, every other platform a tar.gz'() {
-    assert.strictEqual(target().ext, process.platform === 'win32' ? 'zip' : 'tar.gz')
-  },
-
-  'download url points at the tagged release asset'() {
-    assert.strictEqual(
-      downloadUrl('v0.45.0', 'agnostic-ai_linux_amd64.tar.gz'),
-      'https://github.com/Chemaclass/agnostic-ai/releases/download/v0.45.0/agnostic-ai_linux_amd64.tar.gz'
-    )
-  },
-
-  'binary path lands in the package bin dir'() {
-    assert.strictEqual(path.dirname(binaryPath()), path.join(__dirname, '..', 'bin'))
-    assert.match(path.basename(binaryPath()), /^agnostic-ai(\.exe)?$/)
-  },
-
-  async 'env override wins over the package version'() {
-    process.env.AGNOSTIC_AI_VERSION = 'v1.2.3'
-    try {
-      assert.strictEqual(await resolveVersion(), 'v1.2.3')
-    } finally {
-      delete process.env.AGNOSTIC_AI_VERSION
-    }
-  },
-
-  async 'a version pin resolves the same with or without the v prefix'() {
-    try {
-      for (const pin of ['0.61.0', 'v0.61.0', ' 0.61.0 ']) {
-        process.env.AGNOSTIC_AI_VERSION = pin
-        assert.strictEqual(await resolveVersion(), 'v0.61.0', `pin ${JSON.stringify(pin)}`)
-      }
-    } finally {
-      delete process.env.AGNOSTIC_AI_VERSION
-    }
-  },
-
-  async 'an error with no message is described from its code and its causes'() {
-    const port = await closedPort()
-    const err = await multiAddressFailure(port)
-
-    // Guard the premise: this is what the user currently sees printed.
-    assert.ok(err instanceof AggregateError, `expected an AggregateError, got ${err.name}`)
-    assert.strictEqual(err.message, '')
-
-    const described = describeError(err).message
-    assert.ok(described.length > 0, 'described message is empty')
-    assert.match(described, /ECONNREFUSED/)
-    assert.ok(described.includes(`127.0.0.1:${port}`), `missing the address: ${described}`)
-    assert.ok(described.includes('::1'), `missing the second address: ${described}`)
-  },
-
-  'an error that already has a message is left alone'() {
-    const err = new Error('connect ETIMEDOUT 203.0.113.1:443')
-    assert.strictEqual(describeError(err), err)
-  },
-
-  async 'a server that never answers fails with a timeout naming the url'() {
-    // Accept the connection and say nothing: no OS-level timeout ever fires.
-    const accepted = []
-    const server = net.createServer((socket) => accepted.push(socket))
-    const base = await listen(server)
-    try {
-      const err = await rejection(get(`${base}/wedged`, { timeoutMs: 200 }))
-      assert.ok(err.message.includes(`${base}/wedged`), `missing the url: ${err.message}`)
-      assert.match(err.message, /timed out after 0\.2s/)
-    } finally {
-      await close(server, accepted)
-    }
-  },
-
-  async 'a body that stops mid-stream reports the timeout, not `aborted`'() {
-    const server = http.createServer((req, res) => {
-      res.writeHead(200, { 'content-length': '100' })
-      res.write('half a bod') // and then nothing, ever
-    })
-    const base = await listen(server)
-    try {
-      const err = await rejection(get(`${base}/stalled`, { timeoutMs: 200 }))
-      assert.ok(err.message.includes(`${base}/stalled`), `missing the url: ${err.message}`)
-      assert.match(err.message, /timed out after 0\.2s/)
-    } finally {
-      await close(server)
-    }
-  },
-
-  async 'a single redirect is still followed'() {
-    const server = http.createServer((req, res) => {
-      if (req.url === '/asset') {
-        res.writeHead(302, { location: `${base}/storage` })
-        res.end()
-        return
-      }
-      res.writeHead(200)
-      res.end('payload')
-    })
-    const base = await listen(server)
-    try {
-      assert.strictEqual((await get(`${base}/asset`)).toString('utf8'), 'payload')
-    } finally {
-      await close(server)
-    }
-  },
-
-  async 'a redirect loop stops at the cap'() {
-    let hops = 0
-    const server = http.createServer((req, res) => {
-      hops++
-      res.writeHead(302, { location: `${base}/loop` })
-      res.end()
-    })
-    const base = await listen(server)
-    try {
-      const err = await rejection(get(`${base}/loop`))
-      assert.match(err.message, /redirect/i)
-      assert.match(err.message, /5/)
-      assert.ok(hops <= 6, `followed ${hops} hops, expected at most 6`)
-    } finally {
-      await close(server)
-    }
-  },
-
-  async 'the latest release comes from the redirect, not the rate-limited api'() {
-    const seen = []
-    const server = http.createServer((req, res) => {
-      seen.push(req.url)
-      res.writeHead(302, { location: 'https://github.com/Chemaclass/agnostic-ai/releases/tag/v0.62.0' })
-      res.end()
-    })
-    const base = await listen(server)
-    try {
-      assert.strictEqual(await latestTag(`${base}/releases/latest`), 'v0.62.0')
-      assert.deepStrictEqual(seen, ['/releases/latest'])
-    } finally {
-      await close(server)
-    }
-  },
-
-  async 'a rate-limited release lookup says so, a missing release says that'() {
-    let status = 403
-    const server = http.createServer((req, res) => {
-      res.writeHead(status)
-      res.end()
-    })
-    const base = await listen(server)
-    try {
-      const limited = await rejection(latestTag(`${base}/releases/latest`))
-      assert.match(limited.message, /rate-limited/)
-      assert.match(limited.message, /AGNOSTIC_AI_VERSION/)
-
-      status = 404
-      const missing = await rejection(latestTag(`${base}/releases/latest`))
-      assert.match(missing.message, /no published release/)
-      assert.ok(!/rate-limited/.test(missing.message), missing.message)
-    } finally {
-      await close(server)
-    }
-  },
-
-  'a failed extraction names the archive and an alternative install route'() {
-    const work = fs.mkdtempSync(path.join(os.tmpdir(), 'agnostic-ai-extract-'))
-    try {
-      const archive = path.join(work, 'agnostic-ai_broken.tar.gz')
-      fs.writeFileSync(archive, 'not an archive')
-      const err = thrown(() => extract(archive, work))
-      assert.ok(err.message.includes('agnostic-ai_broken.tar.gz'), `missing the archive: ${err.message}`)
-      assert.match(err.message, /go install github\.com\/chemaclass\/agnostic-ai/)
-    } finally {
-      fs.rmSync(work, { recursive: true, force: true })
-    }
-  },
-
-  'the bin shim exits with 128 plus the signal number'() {
-    if (process.platform === 'win32') {
-      console.log('     skipped: no POSIX signals on windows')
-      return
-    }
-    const work = fs.mkdtempSync(path.join(os.tmpdir(), 'agnostic-ai-shim-'))
-    try {
-      fs.mkdirSync(path.join(work, 'bin'))
-      fs.mkdirSync(path.join(work, 'lib'))
-      fs.writeFileSync(path.join(work, 'package.json'), '{"version":"0.0.0-dev"}')
-      fs.copyFileSync(path.join(__dirname, 'download.js'), path.join(work, 'lib', 'download.js'))
-      const shim = path.join(work, 'bin', 'agnostic-ai.js')
-      fs.copyFileSync(path.join(__dirname, '..', 'bin', 'agnostic-ai.js'), shim)
-
-      // ensureBinary short-circuits on an existing binary, so the shim spawns
-      // this stub instead of downloading anything. It kills itself with
-      // SIGTERM (15), so the shim must report 143.
-      const stub = path.join(work, 'bin', 'agnostic-ai')
-      fs.writeFileSync(stub, '#!/bin/sh\nkill -TERM $$\n')
-      fs.chmodSync(stub, 0o755)
-
-      const run = spawnSync(process.execPath, [shim], { encoding: 'utf8' })
-      assert.strictEqual(run.status, 128 + os.constants.signals.SIGTERM, run.stderr)
-    } finally {
-      fs.rmSync(work, { recursive: true, force: true })
-    }
-  },
-}
-
-async function run() {
-  let failed = 0
-  for (const [name, fn] of Object.entries(tests)) {
-    try {
-      await fn()
-      console.log(`ok   ${name}`)
-    } catch (err) {
-      failed++
-      console.error(`FAIL ${name}\n     ${err.message}`)
-    }
-  }
-  console.log(`\n${Object.keys(tests).length - failed} passed, ${failed} failed`)
-  // exitCode, not exit(): process.exit() drops whatever stdout has not flushed
-  // yet, which silently swallows the tail of the report when it runs in CI with
-  // stdout on a pipe.
-  process.exitCode = failed === 0 ? 0 : 1
-}
-
-run()

package/scripts/postinstall.js

@@ -1,12 +0,0 @@
-'use strict'
-
-// Downloads the binary at install time. A failure here is a warning, never an
-// install error: the bin shim retries on first run, so an offline install or a
-// blocked proxy does not break `npm install` for the whole project.
-
-const { ensureBinary } = require('../lib/download')
-
-ensureBinary({ log: (m) => console.log(`agnostic-ai: ${m}`) }).catch((err) => {
-  console.warn(`agnostic-ai: ${err.message}`)
-  console.warn('agnostic-ai: the binary will be fetched on first run instead')
-})